Veeam B&R 9.5 U3a - Logon failure: the user has not been...

Veeam released Veeam Backup and Replication 9.5 Update 3a, which contains some significant improvements: VMware vSphere 6.7 and VMware vCloud Director 9.1 support, Microsoft Windows 10 & Microsoft Windows Server Updates integration and others. After upgrading Veeam Backup & Replication 9.5 to Update 3a, you may notice warning or failures on the following operations while the error message varies depending on the actual operation, there is a common error thrown in the job sessions: “Logon failure: the user has not been granted the requested logon type at this computer. Code: 1385“. Backup jobs for SQL Servers VM with Backup logs periodically option enabled for transaction log backup may complete with this warning message: “Unable to update SQL backupset for instance SQLEXPRESS : Code = 0x80040e09 Code meaning = IDispatch error #3081 Source = Microsoft OLE DB Provider for SQL Server Description = The UPDATE permission was denied on the object ‘backupset’, database ‘msdb’, schema ‘dbo’“…

Cause:

The issue has to deal with Microsoft SQL Server backups. Before Update Veeam V&R 9.5 3a, application-aware processing logic required that the account used to connect to SQL Server has interactive logon rights to perform transaction logs processing. This required “Deny” log on locally and “Deny” log on through Terminal Services to be turned off for this account, and a lot of Veeam’s customers require those privileges. So as of Update 3a, Veeam stopped using interactive logon and instead changed the logic to logon as a batch job, which is better from security perspective. However, this does require that the account now has “Deny” log on as a batch job disabled instead.

Solution:

Veeam created a hotfix does is allowing for smoother adoption of the updated system requirements transparently failing over to interactive logon (which was used before Veeam B&R 9.5 Update 3a) if logon as a batch job fails, plus it changes the newly added warning to an informational event that also more clearly explains the consequences of not fixing account’s permissions. So while setting up the account used for SQL Server processing according to the updated system requirements remains the preferred solution, if this is not possible you can install this hotfix: KB2689.

Veeam recommends that you adjust permissions and rights of the account specified with for use with Application-Aware Processing within the Veeam Backup & Replication jobs.

To install the hotfix:

1) Stop Veeam jobs and Veeam services,

2) Make a backup copy of the following files, from the backup server and all guest interaction proxies:

C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.Core.dll
C:\Program Files\Veeam\Backup and Replication\Backup\Veeam.Backup.VssProvider.dll
C:\Program Files\Veeam\Backup and Replication\Backup\VSS\sql\VeeamLogShipper_X64.exe
C:\Program Files\Veeam\Backup and Replication\Backup\VSS\sql\VeeamLogShipper_X86.exe
C:\Program Files (x86)\Veeam\Backup Transport\GuestInteraction\VSS\sql\VeeamLogShipper_X64.exe
C:\Program Files (x86)\Veeam\Backup Transport\GuestInteraction\VSS\sql\VeeamLogShipper_X86.exe
C:\Program Files\Veeam\Backup and Replication\Backup\VSS\VeeamGuestHelpers\VeeamVssSupport2008R2_X64.dll
C:\Program Files\Veeam\Backup and Replication\Backup\VSS\VeeamGuestHelpers\VeeamVssSupport2003_X64.dll
C:\Program Files\Veeam\Backup and Replication\Backup\VSS\VeeamGuestHelpers\VeeamVssSupport2003_X86.dll
C:\Program Files\Veeam\Backup and Replication\Backup\VSS\VeeamGuestHelpers\VeeamVssSupportXP_X86.dll
C:\Program Files (x86)\Veeam\Backup Transport\GuestInteraction\VSS\VeeamGuestHelpers\VeeamVssSupport2008R2_X64.dll
C:\Program Files (x86)\Veeam\Backup Transport\GuestInteraction\VSS\VeeamGuestHelpers\VeeamVssSupport2003_X64.dll
C:\Program Files (x86)\Veeam\Backup Transport\GuestInteraction\VSS\VeeamGuestHelpers\VeeamVssSupport2003_X86.dll
C:\Program Files (x86)\Veeam\Backup Transport\GuestInteraction\VSS\VeeamGuestHelpers\VeeamVssSupportXP_X86.dll